classes:
- system.salt.minion.cert.mysql.clients.openstack.ironic
- system.salt.minion.cert.rabbitmq.clients.openstack.ironic
- service.ironic.conductor.cluster
parameters:
  _param:
    ironic_conductor_api_url_protocol: 'http'
  linux:
    system:
      package:
        python-pymysql:
          fromrepo: ${_param:openstack_version}
          version: latest
  ironic:
    conductor:
      api_url: '${_param:ironic_conductor_api_url_protocol}://${_param:cluster_baremetal_vip_address}:6385'
      database:
        x509:
          enabled: ${_param:openstack_mysql_x509_enabled}
          ca_file: ${_param:mysql_ironic_ssl_ca_file}
          key_file: ${_param:mysql_ironic_client_ssl_key_file}
          cert_file: ${_param:mysql_ironic_client_ssl_cert_file}
        ssl:
          enabled: ${_param:galera_ssl_enabled}
      message_queue:
        members:
          - host: ${_param:openstack_message_queue_node01_address}
          - host: ${_param:openstack_message_queue_node02_address}
          - host: ${_param:openstack_message_queue_node03_address}
        port: ${_param:openstack_rabbitmq_port}
        x509:
          enabled: ${_param:openstack_rabbitmq_x509_enabled}
          ca_file: ${_param:rabbitmq_ironic_ssl_ca_file}
          key_file: ${_param:rabbitmq_ironic_client_ssl_key_file}
          cert_file: ${_param:rabbitmq_ironic_client_ssl_cert_file}
        ssl:
          enabled: ${_param:rabbitmq_ssl_enabled}
      cache:
        security:
          enabled: ${_param:ironic_memcache_security_enabled}
          strategy: ${_param:openstack_memcache_security_strategy}
          secret_key: ${_param:ironic_memcache_secret_key}
      identity:
        region: ${_param:openstack_region}
        protocol: ${_param:cluster_internal_protocol}
        user: ${_param:keystone_ironic_username}
      automated_clean: true
      erase_devices_priority: 0
      erase_devices_metadata_priority: 1
      console:
        enabled: ${_param:ironic_console_enabled}
      enabled_console_interfaces:
        - ipmitool-shellinabox
        - ipmitool-socat
        - no-console
      pxe_append_params: 'nofb nomodeset vga=normal ipa-insecure=1'